Issue OwlCyberDefense#86: Get CLIP RHEL7 booting in Enforcing

- Include systemd policy via init_systemd ifdef - Various Makefile/specfile changes - Modify init interfaces to support old init scripts -- Systemd still supports traditional init scripts, so modify init_daemon_domain and init_system_domain to allow both initrc_t and init_t transitions if systemd policy is turned on. Else, default to only intrc_t transitions. - Separate long-running processes/daemons into their own contexts - Let short-running processes fall through to initrc - Label unit files - Add some file_contexts.subs_dist mappings - Updates for systemd_logind_t - Add permissions for systemd_logind_t
mpalmi · Jun 4, 2015 · 9d972e9 · 9d972e9
1 parent dd8e3fe
commit 9d972e9
Show file tree

Hide file tree

Showing 53 changed files with 2,210 additions and 172 deletions.
diff --git a/packages/clip-selinux-policy/20140512.zip b/packages/clip-selinux-policy/20140512.zip
diff --git a/packages/clip-selinux-policy/clip-selinux-policy.spec b/packages/clip-selinux-policy/clip-selinux-policy.spec
@@ -56,10 +56,10 @@ Certifiable Linux Integration Platform SELinux policy documentation package
 #make %{?_smp_mflags} UNK_PERMS=%5 NAME=%1 TYPE=%2 DISTRO=%{distro} UBAC=y DIRECT_INITRC=%3 MONOLITHIC=%{monolithic} POLY=%4 MLS_CATS=1024 MCS_CATS=1024  conf \
 
 %define installCmds() \
-make %{?_smp_mflags} UNK_PERMS=%5 NAME=%1 TYPE=%2 DISTRO=%{distro} UBAC=y DIRECT_INITRC=%3 MONOLITHIC=%{monolithic} POLY=%4 MLS_CATS=1024 MCS_CATS=1024 APPS_MODS=""%{enable_modules}"" base.pp \
-make %{?_smp_mflags} validate UNK_PERMS=%5 NAME=%1 TYPE=%2 DISTRO=%{distro} UBAC=y DIRECT_INITRC=%3 MONOLITHIC=%{monolithic} POLY=%4 MLS_CATS=1024 MCS_CATS=1024 APPS_MODS=""%{enable_modules}"" modules \
-make %{?_smp_mflags} UNK_PERMS=%5 NAME=%1 TYPE=%2 DISTRO=%{distro} UBAC=y DIRECT_INITRC=%3 MONOLITHIC=%{monolithic} DESTDIR=%{buildroot} POLY=%4 MLS_CATS=1024 MCS_CATS=1024 APPS_MODS=""%{enable_modules}"" install \
-make %{?_smp_mflags} UNK_PERMS=%5 NAME=%1 TYPE=%2 DISTRO=%{distro} UBAC=y DIRECT_INITRC=%3 MONOLITHIC=%{monolithic} DESTDIR=%{buildroot} POLY=%4 MLS_CATS=1024 MCS_CATS=1024 APPS_MODS=""%{enable_modules}"" install-appconfig \
+make %{?_smp_mflags} UNK_PERMS=%5 NAME=%1 TYPE=%2 DISTRO=%{distro} INIT_SYSTEMD=y UBAC=y DIRECT_INITRC=%3 MONOLITHIC=%{monolithic} POLY=%4 MLS_CATS=1024 MCS_CATS=1024 APPS_MODS=""%{enable_modules}"" base.pp \
+make %{?_smp_mflags} validate UNK_PERMS=%5 NAME=%1 TYPE=%2 DISTRO=%{distro} INIT_SYSTEMD=y UBAC=y DIRECT_INITRC=%3 MONOLITHIC=%{monolithic} POLY=%4 MLS_CATS=1024 MCS_CATS=1024 APPS_MODS=""%{enable_modules}"" modules \
+make %{?_smp_mflags} UNK_PERMS=%5 NAME=%1 TYPE=%2 DISTRO=%{distro} INIT_SYSTEMD=y UBAC=y DIRECT_INITRC=%3 MONOLITHIC=%{monolithic} DESTDIR=%{buildroot} POLY=%4 MLS_CATS=1024 MCS_CATS=1024 APPS_MODS=""%{enable_modules}"" install \
+make %{?_smp_mflags} UNK_PERMS=%5 NAME=%1 TYPE=%2 DISTRO=%{distro} INIT_SYSTEMD=y UBAC=y DIRECT_INITRC=%3 MONOLITHIC=%{monolithic} DESTDIR=%{buildroot} POLY=%4 MLS_CATS=1024 MCS_CATS=1024 APPS_MODS=""%{enable_modules}"" install-appconfig \
 #%{__cp} *.pp %{buildroot}/%{_usr}/share/selinux/%1/ \
 %{__mkdir} -p %{buildroot}/%{_sysconfdir}/selinux/%1/policy \
 %{__mkdir} -p %{buildroot}/%{_sysconfdir}/selinux/%1/modules/active \
@@ -128,7 +128,7 @@ fi
 
 %define loadpolicy() \
 . %{_sysconfdir}/selinux/config; \
-( cd /usr/share/selinux/%1; semodule -n -b base.pp.bz2 -i %2 -s %1 2>&1 ); \
+( cd /usr/share/selinux/%1; semodule -n -b base.pp.bz2 -i %2 -s %1 2>&1 | /bin/tee /tmp/load_policy.log ); \
 
 %define relabel() \
 . %{_sysconfdir}/selinux/config; \
@@ -200,6 +200,7 @@ SELINUX=%{enforcing_mode}
 #     clip - Targeted processes are protected,
 #     mls - Multi Level Security protection.
 SELINUXTYPE=clip 
+AUTORELABEL=1
 
 " > /etc/selinux/config
 
@@ -245,14 +246,15 @@ Based off of reference policy refpolicy-2.20110726.tar.bz2
 %post clip
 packages=`cat /usr/share/selinux/clip/modules.lst`
 if [ $1 -eq 1 ]; then
-   %loadpolicy clip $packages
-   restorecon -R /root /var/log /var/run 2> /dev/null
+   %loadpolicy clip $packages 2>> /tmp/policy_load.log
+   restorecon -R /root /var/log /var/run 2>> /tmp/policy_load.log
 else
 #   semodule -n -s clip 2>/dev/null
-   %loadpolicy clip $packages
-   %relabel clip
+   %loadpolicy clip $packages 2>> /tmp/policy_load.log
+   %relabel clip 2>> /tmp/policy_load.log
 fi
-touch /.autorelabel
+
+echo "-F" > /.autorelabel
 exit 0
 
 %files clip

diff --git a/packages/clip-selinux-policy/clip-selinux-policy/Makefile b/packages/clip-selinux-policy/clip-selinux-policy/Makefile
@@ -212,6 +212,10 @@ ifeq "$(UBAC)" "y"
 	M4PARAM += -D enable_ubac
 endif
 
+ifeq "$(INIT_SYSTEMD)" "y"
+	M4PARAM += -D init_systemd
+endif
+
 # default MLS/MCS sensitivity and category settings.
 MLS_SENS ?= 16
 MLS_CATS ?= 1024

diff --git a/packages/clip-selinux-policy/clip-selinux-policy/build.conf b/packages/clip-selinux-policy/clip-selinux-policy/build.conf
@@ -27,7 +27,7 @@ NAME = refpolicy
 # for the distribution.
 # redhat, gentoo, debian, suse, and rhel4 are current options.
 # Fedora users should enable redhat.
-#DISTRO = redhat
+DISTRO = redhat
 
 # Unknown Permissions Handling
 # The behavior for handling permissions defined in the
@@ -75,3 +75,6 @@ MCS_CATS = 1024
 # Set this to y to only display status messages
 # during build.
 QUIET = n
+
+# systemd for init
+INIT_SYSTEMD = y
diff --git a/packages/clip-selinux-policy/clip-selinux-policy/config/file_contexts.subs_dist b/packages/clip-selinux-policy/clip-selinux-policy/config/file_contexts.subs_dist
@@ -9,14 +9,24 @@
 # example, but aliasing.
 # 
 /etc/init.d /etc/rc.d/init.d
+/etc/systemd/system /usr/lib/systemd/system
 /lib/systemd /usr/lib/systemd
 /lib32 /lib
 /lib64 /lib
 /run /var/run
 /run/lock /var/lock
+/run/systemd/system /usr/lib/systemd/system
+/run/systemd/generator /usr/lib/systemd/system
 /usr/lib32 /usr/lib
 /usr/lib64 /usr/lib
 /usr/local/lib32 /usr/lib
 /usr/local/lib64 /usr/lib
 /usr/local/lib /usr/lib
 /var/run/lock /var/lock
+/var/lib/xguest/home /home
+/var/named/chroot/usr/lib64 /usr/lib
+/var/named/chroot/lib64 /usr/lib
+/var/home   /home
+/var/roothome /root
+/usr/bin /bin
+/usr/sbin /sbin
diff --git a/packages/clip-selinux-policy/clip-selinux-policy/policy/modules.conf b/packages/clip-selinux-policy/clip-selinux-policy/policy/modules.conf
@@ -1007,7 +1007,7 @@ cgroup = off
 #
 # Chrony NTP background daemon
 # 
-chronyd = off
+chronyd = module
 
 # Layer: services
 # Module: cipe
@@ -1147,7 +1147,7 @@ dbskk = off
 #
 # Desktop messaging bus
 # 
-dbus = off
+dbus = module
 
 # Layer: services
 # Module: dcc
@@ -1182,7 +1182,7 @@ devicekit = off
 #
 # Dynamic host configuration protocol (DHCP) server
 # 
-dhcp = off
+dhcp = module
 
 # Layer: services
 # Module: dictd
@@ -2351,6 +2351,12 @@ hotplug = off
 # 
 init = base
 
+# Layer: system
+# Module: systemd
+# 
+# Policy for systemd
+systemd = base
+
 # Layer: system
 # Module: ipsec
 #
@@ -2491,3 +2497,9 @@ userdomain = base
 # 
 xen = off
 
+# Layer: contrib
+# Module: firewalld
+#
+# Policy for firewalld.
+firewalld = module
+
diff --git a/packages/clip-selinux-policy/clip-selinux-policy/policy/modules/admin/dmesg.te b/packages/clip-selinux-policy/clip-selinux-policy/policy/modules/admin/dmesg.te
@@ -29,6 +29,7 @@ kernel_read_proc_symlinks(dmesg_t)
 kernel_dontaudit_search_unlabeled(dmesg_t)
 
 dev_read_sysfs(dmesg_t)
+dev_read_kmsg(dmesg_t)
 
 fs_search_auto_mountpoints(dmesg_t)
 

diff --git a/packages/clip-selinux-policy/clip-selinux-policy/policy/modules/admin/netutils.te b/packages/clip-selinux-policy/clip-selinux-policy/policy/modules/admin/netutils.te
@@ -35,7 +35,7 @@ init_system_domain(traceroute_t, traceroute_exec_t)
 # Perform network administration operations and have raw access to the network.
 allow netutils_t self:capability { dac_read_search net_admin net_raw setuid setgid sys_chroot };
 dontaudit netutils_t self:capability { dac_override sys_tty_config };
-allow netutils_t self:process { setcap signal_perms };
+allow netutils_t self:process { getcap setcap signal_perms };
 allow netutils_t self:netlink_route_socket create_netlink_socket_perms;
 allow netutils_t self:netlink_socket create_socket_perms;
 allow netutils_t self:packet_socket create_socket_perms;

diff --git a/packages/clip-selinux-policy/clip-selinux-policy/policy/modules/apps/oscap.fc b/packages/clip-selinux-policy/clip-selinux-policy/policy/modules/apps/oscap.fc
@@ -1,2 +1,5 @@
-/usr/bin/oscap						--		gen_context(system_u:object_r:oscap_exec_t,s0)
+/bin/oscap							--		gen_context(system_u:object_r:oscap_exec_t,s0)
 /usr/libexec/openscap/probe_.*		--		gen_context(system_u:object_r:oscap_probe_exec_t,s0)
+
+/root/ssg									gen_context(system_u:object_r:ssg_file_t,s0)
+
diff --git a/packages/clip-selinux-policy/clip-selinux-policy/policy/modules/apps/oscap.te b/packages/clip-selinux-policy/clip-selinux-policy/policy/modules/apps/oscap.te
@@ -16,6 +16,10 @@ type oscap_probe_exec_t;
 application_domain(oscap_probe_t, oscap_probe_exec_t)
 role system_r types oscap_probe_t;
 
+# oscap plays with ssg files
+type ssg_file_t;
+files_type(ssg_file_t)
+
 ########################################
 #
 # oscap local policy

diff --git a/packages/clip-selinux-policy/clip-selinux-policy/policy/modules/contrib/chronyd.fc b/packages/clip-selinux-policy/clip-selinux-policy/policy/modules/contrib/chronyd.fc
@@ -2,6 +2,8 @@
 
 /etc/rc\.d/init\.d/chronyd	--	gen_context(system_u:object_r:chronyd_initrc_exec_t,s0)
 
+/sbin/chronyd	--	gen_context(system_u:object_r:chronyd_exec_t,s0)
+
 /usr/sbin/chronyd	--	gen_context(system_u:object_r:chronyd_exec_t,s0)
 
 /var/lib/chrony(/.*)?	gen_context(system_u:object_r:chronyd_var_lib_t,s0)

diff --git a/packages/clip-selinux-policy/clip-selinux-policy/policy/modules/contrib/chronyd.te b/packages/clip-selinux-policy/clip-selinux-policy/policy/modules/contrib/chronyd.te
@@ -33,11 +33,17 @@ files_pid_file(chronyd_var_run_t)
 #
 
 allow chronyd_t self:capability { dac_override ipc_lock setuid setgid sys_resource sys_time };
+#uncomment this if it works after testing in enforcing
+#dontaudit chronyd_t self:capability fsetid;
 allow chronyd_t self:process { getcap setcap setrlimit signal };
 allow chronyd_t self:shm create_shm_perms;
 allow chronyd_t self:fifo_file rw_fifo_file_perms;
 
 allow chronyd_t chronyd_keys_t:file read_file_perms;
+# allow chronyd to create key if not present
+allow chronyd_t chronyd_keys_t:file append_file_perms;
+# allow chronyd to change perms to not be world readable
+allow chronyd_t chronyd_keys_t:file setattr_file_perms;
 
 manage_dirs_pattern(chronyd_t, chronyd_tmpfs_t, chronyd_tmpfs_t)
 manage_files_pattern(chronyd_t, chronyd_tmpfs_t, chronyd_tmpfs_t)
@@ -61,6 +67,10 @@ files_pid_filetrans(chronyd_t, chronyd_var_run_t, { dir file sock_file })
 
 kernel_read_system_state(chronyd_t)
 kernel_read_network_state(chronyd_t)
+kernel_read_crypto_sysctls(chronyd_t)
+
+dev_read_rand(chronyd_t)
+dev_read_urand(chronyd_t)
 
 corenet_all_recvfrom_unlabeled(chronyd_t)
 corenet_all_recvfrom_netlabel(chronyd_t)

diff --git a/packages/clip-selinux-policy/clip-selinux-policy/policy/modules/contrib/cron.fc b/packages/clip-selinux-policy/clip-selinux-policy/policy/modules/contrib/cron.fc
@@ -1,8 +1,13 @@
+/bin/(f)?crontab	--	gen_context(system_u:object_r:crontab_exec_t,s0)
+
 /etc/rc\.d/init\.d/(anacron|atd)	--	gen_context(system_u:object_r:crond_initrc_exec_t,s0)
 
 /etc/cron\.d(/.*)?	gen_context(system_u:object_r:system_cron_spool_t,s0)
 /etc/crontab	--	gen_context(system_u:object_r:system_cron_spool_t,s0)
 
+/sbin/anacron	--	gen_context(system_u:object_r:anacron_exec_t,s0)
+/sbin/cron(d)?	--	gen_context(system_u:object_r:crond_exec_t,s0)
+
 /usr/bin/at	--	gen_context(system_u:object_r:crontab_exec_t,s0)
 /usr/bin/(f)?crontab	--	gen_context(system_u:object_r:crontab_exec_t,s0)
 

diff --git a/packages/clip-selinux-policy/clip-selinux-policy/policy/modules/contrib/cron.te b/packages/clip-selinux-policy/clip-selinux-policy/policy/modules/contrib/cron.te
@@ -409,6 +409,10 @@ optional_policy(`
 	rpm_read_pipes(crond_t)
 ')
 
+optional_policy(`
+	systemd_logind_dbus_chat(crond_t)
+')
+
 optional_policy(`
 	seutil_sigchld_newrole(crond_t)
 ')

diff --git a/packages/clip-selinux-policy/clip-selinux-policy/policy/modules/contrib/dbus.te b/packages/clip-selinux-policy/clip-selinux-policy/policy/modules/contrib/dbus.te
@@ -118,6 +118,14 @@ selinux_compute_create_context(system_dbusd_t)
 selinux_compute_relabel_context(system_dbusd_t)
 selinux_compute_user_contexts(system_dbusd_t)
 
+optional_policy(`
+	ifdef(`init_systemd',`
+		systemd_socket_activated(system_dbusd_t, system_dbusd_var_run_t)
+		systemd_logind_use_fds(system_dbusd_t)
+		systemd_logind_manage_pid_pipes(system_dbusd_t)
+	')
+')
+
 term_dontaudit_use_console(system_dbusd_t)
 
 auth_use_nsswitch(system_dbusd_t)

diff --git a/packages/clip-selinux-policy/clip-selinux-policy/policy/modules/contrib/dhcp.fc b/packages/clip-selinux-policy/clip-selinux-policy/policy/modules/contrib/dhcp.fc
@@ -1,5 +1,7 @@
 /etc/rc\.d/init\.d/dhcpd(6)?	--	gen_context(system_u:object_r:dhcpd_initrc_exec_t,s0)
 
+/sbin/dhcpd.*	--	gen_context(system_u:object_r:dhcpd_exec_t,s0)
+
 /usr/sbin/dhcpd.*	--	gen_context(system_u:object_r:dhcpd_exec_t,s0)
 
 /var/lib/dhcpd(/.*)?	gen_context(system_u:object_r:dhcpd_state_t,s0)

diff --git a/packages/clip-selinux-policy/clip-selinux-policy/policy/modules/contrib/firewalld.fc b/packages/clip-selinux-policy/clip-selinux-policy/policy/modules/contrib/firewalld.fc
@@ -2,7 +2,9 @@
 
 /etc/firewalld(/.*)?	gen_context(system_u:object_r:firewalld_etc_rw_t,s0)
 
-/usr/sbin/firewalld	--	gen_context(system_u:object_r:firewalld_exec_t,s0)
+/sbin/firewalld	--	gen_context(system_u:object_r:firewalld_exec_t,s0)
+
+/usr/sbin/firewalld	    --	gen_context(system_u:object_r:firewalld_exec_t,s0)
 
 /var/log/firewalld.*	--	gen_context(system_u:object_r:firewalld_var_log_t,s0)
 

diff --git a/packages/clip-selinux-policy/clip-selinux-policy/policy/modules/contrib/readahead.fc b/packages/clip-selinux-policy/clip-selinux-policy/policy/modules/contrib/readahead.fc
@@ -1,7 +1,11 @@
-/sbin/readahead.*	--	gen_context(system_u:object_r:readahead_exec_t,s0)
+/dev/\.systemd/readahead(/.*)?			gen_context(system_u:object_r:readahead_var_run_t,s0)
+
+/sbin/readahead.*		--	gen_context(system_u:object_r:readahead_exec_t,s0)
 
 /usr/sbin/readahead.*	--	gen_context(system_u:object_r:readahead_exec_t,s0)
 
+/usr/lib/systemd/systemd-readahead	--	gen_context(system_u:object_r:readahead_exec_t,s0)
+
 /var/lib/readahead(/.*)?	gen_context(system_u:object_r:readahead_var_lib_t,s0)
 
-/var/run/readahead.*	gen_context(system_u:object_r:readahead_var_run_t,s0)
+/var/run/readahead.*		gen_context(system_u:object_r:readahead_var_run_t,s0)
diff --git a/packages/clip-selinux-policy/clip-selinux-policy/policy/modules/contrib/shutdown.fc b/packages/clip-selinux-policy/clip-selinux-policy/policy/modules/contrib/shutdown.fc
@@ -6,6 +6,8 @@
 
 /usr/lib/upstart/shutdown	--	gen_context(system_u:object_r:shutdown_exec_t,s0)
 
+/usr/lib/systemd/systemd-shutdown -- gen_context(system_u:object_r:shutdown_exec_t,s0)
+
 /usr/sbin/shutdown	--	gen_context(system_u:object_r:shutdown_exec_t,s0)
 
 /var/run/shutdown\.pid	--	gen_context(system_u:object_r:shutdown_var_run_t,s0)
diff --git a/packages/clip-selinux-policy/clip-selinux-policy/policy/modules/kernel/corecommands.fc b/packages/clip-selinux-policy/clip-selinux-policy/policy/modules/kernel/corecommands.fc
@@ -1,7 +1,7 @@
 #
 # /bin
 #
-/bin				-d	gen_context(system_u:object_r:bin_t,s0)
+/bin					gen_context(system_u:object_r:bin_t,s0)
 /bin/.*					gen_context(system_u:object_r:bin_t,s0)
 /bin/d?ash			--	gen_context(system_u:object_r:shell_exec_t,s0)
 /bin/bash			--	gen_context(system_u:object_r:shell_exec_t,s0)
@@ -151,7 +151,8 @@ ifdef(`distro_gentoo',`
 #
 # /sbin
 #
-/sbin				-d	gen_context(system_u:object_r:bin_t,s0)
+/sbin					-d	gen_context(system_u:object_r:bin_t,s0)
+/sbin					-l	gen_context(system_u:object_r:bin_t,s0)
 /sbin/.*				gen_context(system_u:object_r:bin_t,s0)
 /sbin/insmod_ksymoops_clean	--	gen_context(system_u:object_r:bin_t,s0)
 /sbin/mkfs\.cramfs		--	gen_context(system_u:object_r:bin_t,s0)
@@ -195,6 +196,7 @@ ifdef(`distro_gentoo',`
 
 /usr/lib/avahi/avahi-daemon-check-dns\.sh	--	gen_context(system_u:object_r:bin_t,s0)
 /usr/lib/ccache/bin(/.*)?		gen_context(system_u:object_r:bin_t,s0)
+/usr/lib/dracut(/.*)?			gen_context(system_u:object_r:bin_t,s0)
 /usr/lib/fence(/.*)?			gen_context(system_u:object_r:bin_t,s0)
 /usr/lib/pgsql/test/regress/.*\.sh --	gen_context(system_u:object_r:bin_t,s0)
 /usr/lib/qt.*/bin(/.*)?			gen_context(system_u:object_r:bin_t,s0)
@@ -234,7 +236,12 @@ ifdef(`distro_gentoo',`
 /usr/lib/rpm/rpmv		-- 	gen_context(system_u:object_r:bin_t,s0)
 /usr/lib/sftp-server		--	gen_context(system_u:object_r:bin_t,s0)
 /usr/lib/sudo/sesh		--	gen_context(system_u:object_r:shell_exec_t,s0)
-/usr/lib/systemd/systemd-random-seed -- gen_context(system_u:object_r:bin_t,s0)
+
+ifdef(`init_systemd',`
+/usr/lib/systemd/systemd-.*	--	gen_context(system_u:object_r:bin_t,s0)
+')
+
+
 /usr/lib/tumbler-1/tumblerd	--	gen_context(system_u:object_r:bin_t,s0)
 /usr/lib/vte/gnome-pty-helper	--	gen_context(system_u:object_r:bin_t,s0)
 /usr/lib/xfce4/exo-1/exo-compose-mail-1 -- gen_context(system_u:object_r:bin_t,s0)